From nobody Tue Jun 9 19:18:41 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gZdxG3FFqz6gV8M for ; Tue, 09 Jun 2026 19:18:42 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R13" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gZdxF6qvZz3NX7 for ; Tue, 09 Jun 2026 19:18:41 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1781032722; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=UdYHrbgIEhyENyND0buDUUW93oJVie+LngaRFRBJDCM=; b=xg4Xw6AgYi3xieTRsTBG0y3Ah1Knj0qY9WcWy0UqhhtM3wKJQwlErEs36/YdtTEy5/kKxy aEJOKqYa1T/0xoXHLBmaQx3N6WDCi+yhJgCbXK4ip1iQykJvxsBWVTeMt+0yIKap4evloj mIM+PHYjRwaoJGo5D5rxAcmA2kc41ve4vdTAbcglMDulqGES/vHB/U1HDC7X2QquEgkrum euRLyx0sxON7etJ1DoZEZdyBUVBFq1GVly/erYHBG2CnFzNqW4Fo8s4J01tqUNdcKmESQK dO0OKcOObItSS8Z0hZZCWdMEypLq4LOCxX6jVD+9QJXgcFoQQXC17GUlvCWJGQ== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1781032722; a=rsa-sha256; cv=none; b=PmdVekRTe0zW9j3UmQS1Oq0LqF9+uRsMJMzCWAcydY/Yj1C22XXCYgE4/4DJyjKM2j8tce iIBJgjk0kWO83uG29Eq5IkvBROXtzMxQIzJ90YhOap5xgOv8v69rgUtW52I0t/jZOBu7rN NtSpEoCdulDfcn1qPkcUwV7y/tM4WgPCuafkKiTq12TdC+VTx05FPwHA/zgMGbwlze5tk9 Xq7z+vroFPyF9HGI2qZM/UnBsJpLlRSEnqZ1b3QordcqE5cQknfJR4KoOLMLq9Qx4LwCQ8 B07I8DU0YcAjvhcuerqaW9TOo5oI3I0J20j6zRQdL+4vHSR8esOWal04UHP9vw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1781032722; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=UdYHrbgIEhyENyND0buDUUW93oJVie+LngaRFRBJDCM=; b=B0UmWRVTUKiXQOo30B3z4aEXZ1LeTagmEREtKa93ZOClkI02ot0rVa8P27PLGpWX1/5nld UVf9CguxlBbMjDPd2OUfzM9Hyb8tZgQL4EN1TEeF7pjit0bxRL9R7zwZViDFnNik2HBNnf 5yzSS+7qiILuxwGAcvD1bKuLzFRtGh4lLKYVGRvrp8tZLDH2nvV1jOUoGIbilo8foWmxtF iplc26+dNSHLpXJi5MdZsELrXSQr9FiA1GW4yIU6548AocYuW9sEhper8MSILkqnp8pWMS dGLn55Z04pVABskxvlk4tutFtdOuvnqx5KUGz6ZMO8xR+ujiPeI1tf9WCckUjA== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gZdxF6MZ9znrS for ; Tue, 09 Jun 2026 19:18:41 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 3c5f2 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 09 Jun 2026 19:18:41 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Cc: Andrew Turner From: Mark Johnston Subject: git: 61d0cea4c00f - releng/14.3 - arm64: Workaround the following errata List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/releng/14.3 X-Git-Reftype: branch X-Git-Commit: 61d0cea4c00fd48ca9cedfd788a58105948aff78 Auto-Submitted: auto-generated Date: Tue, 09 Jun 2026 19:18:41 +0000 Message-Id: <6a286711.3c5f2.51d4f2ed@gitrepo.freebsd.org> The branch releng/14.3 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=61d0cea4c00fd48ca9cedfd788a58105948aff78 commit 61d0cea4c00fd48ca9cedfd788a58105948aff78 Author: Andrew Turner AuthorDate: 2026-05-29 08:31:10 +0000 Commit: Mark Johnston CommitDate: 2026-06-07 17:48:17 +0000 arm64: Workaround the following errata - ARM C1-Premium erratum 4193780 - ARM C1-Ultra erratum 4193780 - ARM Cortex-A76 erratum 4193800 - ARM Cortex-A76AE erratum 4193801 - ARM Cortex-A77 erratum 4193798 - ARM Cortex-A78 erratum 4193791 - ARM Cortex-A78AE erratum 4193793 - ARM Cortex-A78C erratum 4193794 - ARM Cortex-A710 erratum 4193788 - ARM Cortex-X1 erratum 4193791 - ARM Cortex-X1C erratum 4193792 - ARM Cortex-X2 erratum 4193788 - ARM Cortex-X3 erratum 4193786 - ARM Cortex-X4 erratum 4118414 - ARM Cortex-X925 erratum 4193781 - ARM Neoverse-N1 erratum 4193800 - ARM Neoverse-N2 erratum 4193789 - ARM Neoverse-V1 erratum 4193790 - ARM Neoverse-V2 erratum 4193787 - ARM Neoverse-V3 erratum 4193784 - ARM Neoverse-V3AE erratum 4193784 These are all variants on an erratum where TLBI+DSB instructions on one CPU may incorrectly complete early leading to stores to an updated address using an incorrect translation on another CPU. In all cases the workaround is to add a second TLBI+DSB. Sponsored by: Arm Ltd arm64: Add more CPU MIDR values Found in Linux and https://github.com/arm-software/data Sponsored by: Arm Ltd Differential Revision: https://reviews.freebsd.org/D50726 (cherry picked from commit 124b5dbf5c09a17251b75f6b96c9ab7b218eee7f) (cherry picked from commit 935f00c4ddf6c0e90752e7017e1d8d165e0796a1) arm64: Add the new C1 CPU IDs Add the Arm C1-Nano, C1-Pro, C1-Premium, and C1-Ultra CPUs from their Technical Reference Manuals. Sponsored by: Arm Ltd (cherry picked from commit 8fee6b9ecc84d3602a461f1cd33df91e50849cdf) (cherry picked from commit 25ff471f0bbcf5b489678e9f94877386366dc521) Approved by: so Security: FreeBSD-SA-26:31.arm64 Security: CVE-2025-10263 --- sys/arm64/arm64/pmap.c | 79 +++++++++++++++++++++++++++++++++++++++++++++++++ sys/arm64/include/cpu.h | 24 ++++++++++++++- 2 files changed, 102 insertions(+), 1 deletion(-) diff --git a/sys/arm64/arm64/pmap.c b/sys/arm64/arm64/pmap.c index a5d037d7b71c..91b4942b4345 100644 --- a/sys/arm64/arm64/pmap.c +++ b/sys/arm64/arm64/pmap.c @@ -183,6 +183,8 @@ #define PMAP_SAN_PTE_BITS (ATTR_DEFAULT | ATTR_S1_XN | \ ATTR_S1_IDX(VM_MEMATTR_WRITE_BACK) | ATTR_S1_AP(ATTR_S1_AP_RW)) +static bool __read_mostly pmap_multiple_tlbi = false; + struct pmap_large_md_page { struct rwlock pv_lock; struct md_page pv_page; @@ -1534,6 +1536,71 @@ pmap_init_pv_table(void) } } + +static void +pmap_init_multiple_tlbi(void *dummy __unused) +{ + u_int cpu, midr; + + CPU_FOREACH(cpu) { + midr = pcpu_find(cpu)->pc_midr; + + /* + * ARM C1-Premium erratum 4193780 + * ARM C1-Ultra erratum 4193780 + * ARM Cortex-A76 erratum 4193800 + * ARM Cortex-A76AE erratum 4193801 + * ARM Cortex-A77 erratum 4193798 + * ARM Cortex-A78 erratum 4193791 + * ARM Cortex-A78AE erratum 4193793 + * ARM Cortex-A78C erratum 4193794 + * ARM Cortex-A710 erratum 4193788 + * ARM Cortex-X1 erratum 4193791 + * ARM Cortex-X1C erratum 4193792 + * ARM Cortex-X2 erratum 4193788 + * ARM Cortex-X3 erratum 4193786 + * ARM Cortex-X4 erratum 4118414 + * ARM Cortex-X925 erratum 4193781 + * ARM Neoverse-N1 erratum 4193800 + * ARM Neoverse-N2 erratum 4193789 + * ARM Neoverse-V1 erratum 4193790 + * ARM Neoverse-V2 erratum 4193787 + * ARM Neoverse-V3 erratum 4193784 + * ARM Neoverse-V3AE erratum 4193784 + * Present in all revisions + */ + if (CPU_IMPL(midr) == CPU_IMPL_ARM) { + switch(CPU_PART(midr)) { + case CPU_PART_C1_PREMIUM: + case CPU_PART_C1_ULTRA: + case CPU_PART_CORTEX_A76: + case CPU_PART_CORTEX_A76AE: + case CPU_PART_CORTEX_A77: + case CPU_PART_CORTEX_A78: + case CPU_PART_CORTEX_A78AE: + case CPU_PART_CORTEX_A78C: + case CPU_PART_CORTEX_A710: + case CPU_PART_CORTEX_X1: + case CPU_PART_CORTEX_X1C: + case CPU_PART_CORTEX_X2: + case CPU_PART_CORTEX_X3: + case CPU_PART_CORTEX_X4: + case CPU_PART_CORTEX_X925: + case CPU_PART_NEOVERSE_N1: + case CPU_PART_NEOVERSE_N2: + case CPU_PART_NEOVERSE_V1: + case CPU_PART_NEOVERSE_V2: + case CPU_PART_NEOVERSE_V3: + case CPU_PART_NEOVERSE_V3AE: + pmap_multiple_tlbi = true; + return; + } + } + } +} +SYSINIT(pmap_init_multiple_tlbi, SI_SUB_CPU, SI_ORDER_ANY, + pmap_init_multiple_tlbi, NULL); + /* * Initialize the pmap module. * @@ -1652,6 +1719,10 @@ pmap_s1_invalidate_page(pmap_t pmap, vm_offset_t va, bool final_only) r |= ASID_TO_OPERAND(COOKIE_TO_ASID(pmap->pm_cookie)); pmap_s1_invalidate_user(r, final_only); } + if (pmap_multiple_tlbi) { + dsb(ish); + __asm __volatile("tlbi vale1is, xzr" ::: "memory"); + } dsb(ish); isb(); } @@ -1699,6 +1770,10 @@ pmap_s1_invalidate_range(pmap_t pmap, vm_offset_t sva, vm_offset_t eva, for (r = start; r < end; r += TLBI_VA_L3_INCR) pmap_s1_invalidate_user(r, final_only); } + if (pmap_multiple_tlbi) { + dsb(ish); + __asm __volatile("tlbi vale1is, xzr" ::: "memory"); + } dsb(ish); isb(); } @@ -1740,6 +1815,10 @@ pmap_s1_invalidate_all(pmap_t pmap) r = ASID_TO_OPERAND(COOKIE_TO_ASID(pmap->pm_cookie)); __asm __volatile("tlbi aside1is, %0" : : "r" (r)); } + if (pmap_multiple_tlbi) { + dsb(ish); + __asm __volatile("tlbi vale1is, xzr" ::: "memory"); + } dsb(ish); isb(); } diff --git a/sys/arm64/include/cpu.h b/sys/arm64/include/cpu.h index 0701a75d17f7..dbb92d75dd85 100644 --- a/sys/arm64/include/cpu.h +++ b/sys/arm64/include/cpu.h @@ -77,6 +77,7 @@ #define CPU_IMPL_CAVIUM 0x43 #define CPU_IMPL_DEC 0x44 #define CPU_IMPL_FUJITSU 0x46 +#define CPU_IMPL_HISILICON 0x48 #define CPU_IMPL_INFINEON 0x49 #define CPU_IMPL_FREESCALE 0x4D #define CPU_IMPL_NVIDIA 0x4E @@ -86,6 +87,7 @@ #define CPU_IMPL_APPLE 0x61 #define CPU_IMPL_INTEL 0x69 #define CPU_IMPL_AMPERE 0xC0 +#define CPU_IMPL_MICROSOFT 0x6D /* ARM Part numbers */ #define CPU_PART_FOUNDATION 0xD00 @@ -105,6 +107,7 @@ #define CPU_PART_AEM_V8 0xD0F #define CPU_PART_NEOVERSE_V1 0xD40 #define CPU_PART_CORTEX_A78 0xD41 +#define CPU_PART_CORTEX_A78AE 0xD42 #define CPU_PART_CORTEX_A65AE 0xD43 #define CPU_PART_CORTEX_X1 0xD44 #define CPU_PART_CORTEX_A510 0xD46 @@ -117,6 +120,18 @@ #define CPU_PART_CORTEX_A715 0xD4D #define CPU_PART_CORTEX_X3 0xD4E #define CPU_PART_NEOVERSE_V2 0xD4F +#define CPU_PART_CORTEX_A520 0xD80 +#define CPU_PART_CORTEX_A720 0xD81 +#define CPU_PART_CORTEX_X4 0xD82 +#define CPU_PART_NEOVERSE_V3AE 0xD83 +#define CPU_PART_NEOVERSE_V3 0xD84 +#define CPU_PART_CORTEX_X925 0xD85 +#define CPU_PART_CORTEX_A725 0xD87 +#define CPU_PART_C1_NANO 0xD8A +#define CPU_PART_C1_PRO 0xD8B +#define CPU_PART_C1_ULTRA 0xD8C +#define CPU_PART_NEOVERSE_N3 0xD8E +#define CPU_PART_C1_PREMIUM 0xD90 /* Cavium Part numbers */ #define CPU_PART_THUNDERX 0x0A1 @@ -129,9 +144,16 @@ #define CPU_REV_THUNDERX2_0 0x00 -/* APM / Ampere Part Number */ +/* APM (now Ampere) Part number */ #define CPU_PART_EMAG8180 0x000 +/* Ampere Part numbers */ +#define CPU_PART_AMPERE1 0xAC3 +#define CPU_PART_AMPERE1A 0xAC4 + +/* Microsoft Part numbers */ +#define CPU_PART_AZURE_COBALT_100 0xD49 + /* Qualcomm */ #define CPU_PART_KRYO400_GOLD 0x804 #define CPU_PART_KRYO400_SILVER 0x805